DOCSEARCHbyAlgolia
Submit Docs

Rekor Documentation

repository·main·Indexed 22 days ago

https://github.com/sigstore/rekor

Rekor is a transparency log and RESTful API server providing an immutable, tamper-resistant ledger for software supply chain metadata. A core component of the Sigstore ecosystem, it supports pluggable types and schemas including COSE, DSSE, in-toto attestations, and Alpine packages. The project includes a CLI for managing entries and verifying log integrity, with v1 in maintenance mode and v2 under active development using a tile-based log architecture.

Tokens
27.5K
Snippets
104
Records
148
Agent score
78%

What's inside Rekor

  1. What is Rekor?

    main

    Rekor is an immutable, tamper-resistant transparency log designed to provide a ledger of metadata generated within a software supply chain. It allows software maintainers and build systems to record signed metadata to an immutable record, which other parties can then query to verify trust and non-repudiation of an object's lifecycle.

    Rekor provides:

    • A RESTful API-based server for validation.
    • A transparency log for storage.
    • A CLI application for making/verifying entries, querying inclusion proofs, verifying log integrity, and retrieving entries by public key or artifact.

  2. Understand COSE data storage and retrieval in Rekor

    main

    Rekor's storage behavior for COSE envelopes depends on your configuration:

    Default Storage

    By default, Rekor only stores:

    • The hash of the payload
    • The hash of the COSE envelope
    • The public key

    Attestation Storage Configuration

    If Rekor is configured to use attestation storage, the entire COSE envelope is stored as an attestation.

    Important Retrieval Difference: When attestation storage is enabled, the complete envelope is returned in the attestation field of the record, rather than being nested within the body field.

  3. Handle Additional Authenticated Data (AAD) for COSE

    main

    If a COSE envelope is signed using AAD (Additional Authenticated Data), you must provide the exact same AAD data during the upload process. Failure to provide the correct AAD will result in signature verification failure.

    Note: Rekor does not store the AAD data.

  5. What are pluggable types in Rekor

    main
    Rekor uses a system of pluggable types (also known as schemas) to define the structure of entries stored in the transparency log. This allows the log to support diverse data formats—ranging from package metadata to cryptographic envelopes—within a single unified system. Each type is governed by a specific JSON schema that defines its valid fields and versions.

  7. Understand Rekor feature stability levels

    main

    Rekor features are categorized into stability levels following the Sigstore API Stability Policy. This helps developers determine the risk of breaking changes when integrating with specific components:

    • Experimental: Features that are in early development and may undergo significant changes or removal without notice.
    • Beta: Features that are functional but may still have minor changes. This includes the Rekor API (defined in openapi.yaml), the rekor-cli tool, and the rekor/pkg/client client library.
    • General Availability: Stable features that are ready for production use and follow the standard API stability guarantees.

  8. Data stored for DSSE envelopes in Rekor

    main

    When Rekor processes a DSSE envelope, it does not store the entire envelope, even if attestation storage is configured. Instead, Rekor stores only the following specific components:

    • The hash of the payload (the content covered by the digital signature inside the envelope).
    • The hash of the entire DSSE envelope (including signatures).
    • The signature(s).
    • The corresponding verifying materials (e.g., public keys or certificates).

  9. Extend Rekor with custom schemas

    main
    Rekor is designed to be extensible. You can define customized manifests, which Rekor refers to as types. Type customization logic and implementation details can be found in the pkg/types directory of the repository.

  12. Rekor v1 vs Rekor v2

    main

    Rekor v1 is currently in maintenance mode.

    Rekor v2 is under active development and is designed to be easier to maintain and cheaper to operate. Key differences include:

    Progress for v2 can be tracked in the rekor-tiles repository.